Linux Users Groups and Permissions Reference


Copyright:	© 2022 VEXIT , Tomorow is today ® , www.vexit.com
Author:	Vex Tatarevic
Date Created:	2022-05-13

Overview

This file is only a reference manual to help you with managing users and groups in Linux if you don't have a prior knowledge with bash script and Linux.

Use this manual later on in this book as a quick reference to help you find user managment commands at a glance.

Groups

Group is a collection of users.

Primary or login group – is the group that is assigned to the files that are created by the user. Name of the primary group is the same as the name of the user. Each user must belong to exactly one primary group. - Primary group info is stored in the /etc/passwd file.

Secondary or supplementary group - used to grant certain privileges to a set of users. A user can be a member of zero or more secondary groups. - Secondary groups data is stored in the /etc/group file.

Create Group

Create new group "my-group"

sudo groupadd my-group
Create group with specific group id

sudo groupadd -g 1010 my-group

Read Group

List All Groups

List all groups
print to screen
```
getent group
```
OR open group file
```
nano /etc/group
```
For getent use awk or cut to print only the first field containing the name of the group:
```
getent group | awk -F: '{ print $1}'

getent group | cut -d: -f1
```

List User's Groups

List current user's groups

groups
List groups of user "Vex"

groups Vex
first group is the primary group
List groups with their ids

id

id some-user-name

List Members of Group

To find out the members of "my-group" :

getent group my-group

Update Group

Change group name

sudo groupmod -n {{NEW_GROUP_NAME}} {{OLD_GROUP_NAME}}
For example to change group name from developers to devs
```
sudo groupmod -n devs developers
```

Delete Group

Delete group my-group

sudo groupdel my-group

Users

Suppose we are creating user called my-user

Create just user without the user directory, by using the command below, or continue reading to see what other creation options are before you create user:

sudo useradd my-user
Create user and his home directory /home/my-user/

sudo useradd -m my-user
When user is created its data entry is stored in file /etc/passwd with 7 colon-separated fields
- Username: User login name used to login into the system. It should be between 1 to 32 characters long.
- Password: User password (or x character) stored in /etc/shadow file in encrypted format.
- User ID (UID): Every user must have a User ID (UID) User Identification Number. By default, UID 0 is reserved for the root user and UID’s ranging from 1-99 are reserved for other predefined accounts. Further UID’s ranging from 100-999 are reserved for system accounts and groups.
- Group ID (GID): The primary Group ID (GID) Group Identification Number stored in the /etc/group file.
- User Info: This field is optional and allows you to define extra information about the user. For example, user full name. This field is filled by the ‘finger’ command.
- Home Directory: The absolute location of the user’s home directory.
- Shell: The absolute location of a user’s shell i.e. /bin/bash.

Create User

Option 1 - Recommended - ADDUSER Wizard

Create user john

sudo adduser john

You should see :

Adding user `john' ...
Adding new group `john' (1002) ...
Adding new user `john' (1001) with group `john' ...
Creating home directory `/home/john' ...
Copying files from `/etc/skel' ...
New password:
Retype new password:
passwd: password updated successfully
Changing the user information for john
Enter the new value, or press ENTER for the default
        Full Name []: John
        Room Number []:
        Work Phone []:
        Home Phone []:
        Other []:
Is the information correct? [Y/n] Y

NOTE: When you create a user it also creates a group with the same name

Option 2 - USERADD One Liner

Create user john with password pass123 using openssl

sudo useradd -m -p $(openssl passwd -1 pass123) john
Creates user john
Creates group john
-m - creates home directory /home/john
-p - creates password.
openssl - encrypts password with MD5 hash algorithm. The statement "$(openssl passwd -1 pass123)" will return encrypted version of password "pass123"

Option 3 - USERADD + PASSWD

You don't have to set the password in the same command with user creation. You can do it separately in 2 commands:
Create user
```
sudo useradd -m john
```
Set Password
```
sudo passwd my-user
```
- This will prompt you for password
  
  New password:
- Type in the password and hit ENTER - you should see
  
  Retype new password:
- Type in the password again and hit ENTER - you should see
  
  passwd: password updated successfully

IMPORTANT: If hitting ENTER to confirm the new password does not work, use "CTRL + D" instead of "ENTER" to confirm the password.

Read User

List all Users' Details

Local user information is stored in the /etc/passwd file. Each line in this file represents login information for one user.

Each line in the file has seven fields delimited by colons that contain the following information:

Username
Encrypted password (x means that the password is stored in the /etc/shadow file)
User ID number (UID)
User’s group ID number (GID)
Full name of the user (GECOS)
User home directory
Login shell (defaults to /bin/bash)

To open the user accounts file you can either use cat or less

less or nano opens the file

LESS

less /etc/passwd

- Hit leter q to exit out of less

NANO

nano /etc/passwd

cat prints file to the terminal without opening it
```
cat /etc/passwd
```
getent does the same thing
```
getent passwd
```

List all Usernames

Print all users' usernames

awk -F: '{ print $1}' /etc/passwd

OR

cut -d: -f1 /etc/passwd

OR

getent passwd | awk -F: '{ print $1}'

OR

getent passwd | cut -d: -f1

Get User Details

Show details for my-user

getent passwd my-user
Details for user my-user come from file /etc/passwd. You can also use:
```
getent passwd | grep my-user
```

Count users

Show number of users

getent passwd | wc -l

Update User

Change Username

sudo usermod -l {{NEW_USERNAME}} {{OLD_USERNAME}}

To change username john_smith to jons
```
sudo usermod -l jons john_smith
```
- -l - stands for login name

Change Password

Change password for user john

sudo passwd john
You will be prompted to enter new password
```
New password:
```
Type in the new password and hit ENTER - you should see
```
Retype new password:
```
Type in the new password again and hit ENTER - you should see
```
passwd: password updated successfully
```

IMPORTANT: If hitting ENTER to confirm the new password does not work, use "CTRL + D" instead of "ENTER" to confirm the password.

Rename Home Directory

sudo usermod -d /home/{{NEW_USERNAME}} -m {{NEW_USERNAME}}

Rename home directory for user jons

sudo usermod -d /home/jons -m jons
-d - specifies the new home directory
-m - moves the content of the old home directory to the new home directory
NOTE: only new username is used in the command

Change Display Name

Change John's Display Name - from John Smith to Jon S.

sudo usermod -c "Jon S." jons

Show Manual

Display manual of other functions you can do with usermod command

usermod -h

Delete User

Delete user jons

sudo userdel -r -f jons
Removes the account details from the /etc/passwd file
Removes user's primary group jons
-r - removes home directory /home/jons, mail directory /var/mail/jons if they exist
-f - forces removal of files

User Groups

Primary group - Each user has one primary group. Primary group is created by default at the time of user creation and is named the same as username of the user. Primary Group is listed as value of the field gid in the output of the command id.

Supplementary group - is a name for any group other than the primary group that user belongs to. Supplimentary groups are listed at the end of the output for command id.

For example:

Suppose we are logged in as user admin

Type command id

id

You should see an output similar to this

uid=1001(admin) gid=1001(admin) groups=1001(admin),27(sudo),1002(developers)

In the above output:
gid=1001(admin) - tells us that user's primary group is called admin and its id is 1001
groups=1001(admin),27(sudo) - tells us that besides primary group admin, user is also a member of supplementary groups : sudo, developers

Add User to Groups

Use command usermod to assign user jon to the groups: g1, g2 and g3

sudo usermod -aG g1,g2,g3 jon
First argument -aG explained:
- -a, --append - append the user to the supplementary GROUPS mentioned by the -G option without removing him/her from other groups
- -G, --groups GROUPS - new list of supplementary GROUPS
Second argument - name of the group or multiple groups separated by comas, without spaces between
Last argument - username of the user you wish to assign to the groups

NOTE: you must logout and login again for the changes to take effect

View User's Groups

Lets say we have user jon in groups: g1, g2 and g3
View jon's groups

groups jon
You should see the output
```
jon : jon g1 g2 g3
```

Update User Groups

NOT recommended approach. Instead you should use Add or Remove user from group. - Update jon's groups with usermod command followed by -G followed by list of all groups jon should belong to

  sudo usermod -G group1,group2,group3 jon

jon will be removed from all the groups that are not listed in comma separated list

Remove User from Group

Lets say we have user jon in groups: g1, g2 and g3
To remove jon from group g3

gpasswd -d jon g3
You should see the message
```
Removing user jon from group g3
```
View jon's groups

groups jon
you should see
```
jon : jon g1 g2
```

Permissions

CHOWN - Change Owner

Make user admin an owner of /home/repos

sudo chown -R admin /home/repos
-R - to change the user ownership for all the files and directories stored inside the target directory, use argument -R (recursive)

CHGRP - Change Group

Assign group ownership of directory /home/repos and /home/packages to group devs

sudo chgrp -R devs /home/repos /home/packages
-R - to change the group ownership for the files and directories stored inside the target directory, we can use the -R (recursive) option

CHMOD - Change Permissions Modifier

Change permissions on jons-shared directory

sudo chmod 750 /home/jons-shared
Above command will give the following permissions to /home/jons-shared

Entity Permission Permission Description

Owner 7 Read, Write and Execute

Group 5 Read and Execute

Others 0 No Permission
Recursive - To change the permissions for the files and directories inside jons-shared directory, use the -R (recursive) option

sudo chmod -R 750 /home/jons-shared
Above command will apply 750 access to all the files and subfolders of jons-shared folder

For better understanding how permissions work go to File and Folder Permissions section

Administer Users, Groups and File Permissions

Refs:

File Permissions: https://www.computerhope.com/unix/uumask.htm

Create Admin user account

Log in as user "root"

Create user admin

adduser admin

You should see :

Adding user `admin' ...
Adding new group `admin' (1002) ...
Adding new user `admin' (1001) with group `admin' ...
Creating home directory `/home/admin' ...
Copying files from `/etc/skel' ...
New password:
Retype new password:
passwd: password updated successfully
Changing the user information for admin
Enter the new value, or press ENTER for the default
        Full Name []: Admin
        Room Number []:
        Work Phone []:
        Home Phone []:
        Other []:
Is the information correct? [Y/n] Y

NOTE: When you create a user it also creates a group with the same name

Give admin root privilege by assigning them to the sudo group:

usermod -aG sudo admin
Reboot and log in as admin
You now have an admin account that can execute commands as a root using sudo

Create group and add my user to it

As user "admin", create group for software developers on Pi Server:

sudo addgroup dev
Oops we made a mistake. Change group name from dev to developers

sudo groupmod -n developers dev
List all the groups:

cat /etc/group
Add current user admin to developers group:

sudo usermod -aG developers admin
List all groups for my logged-in user admin

groups
- You should see
  
  admin sudo developers
List ids for user and groups that current user belongs to:

id
To run commands groups and id on another user for example my_user, just put the username after the command:

groups my_user

id my_user

Administer access to other users

Add user vex to group developers and group sudo
```
usermod -a -G developers,sudo vex
```
List groups that user vex is in
```
groups vex
```
List ids of the groups that user vex is in
```
id vex
```
List users that belong to the group developers:
```
grep '^developers' /etc/group
```
Remove user vex from group sudo
```
sudo gpasswd -d vex sudo
```

Give group access to dir

Get the developers group id
```
id
```
- You should see something like this if group id is 1001
```
1001(developers)
```
Give developers group access to git repositories on your USB
```
sudo chgrp -R developers /home/my-usb/repos
```
Go into /home/my-usb
Check permisisons on folders :
```
ls -l
```
- l - means long listing, which will display permissions in the first column
- You should see something like:
```
drwxr-xr-x 5 admin developers  ... repos
```

File and Folder Permissions

In Linux, each file is associated with an owner and a group and assigned with permission access rights for three different classes of users:

The file OWNER
The GROUP members
OTHERS (everybody else)

There are three file permissions types that apply to each class:

r - The READ permission
w - The WRITE permission
x - The EXECUTE permission

When we run command ls -l we can see file permissions displayed at the start of each line representing file or folder inside the folder we are currently in.

It looks something like this:

    drwxr-xr-x 5 admin developers 4096 Apr 10 02:21 repos

Symbolic notation

Ten characters that represent symbolic notation of file or folder permisisons are: drwxrwxrwx

The first character, d, signifies that the file is a directory. It can be blank (-) or one of the following characters:

d: directory
c: Character device
b: Block device
s: socket
p: pipe
D: Door
l: symbolic link etc.

FIRST set of three characters (drwxr-xr-x), are permissions for the OWNER of the file/folder
SECOND set of three characters (drwxr-xr-x), permissions for the GROUP
THIRD set of three characters (drwxr-xr-x), permissions for all the OTHER users
Character meaning is as follows:
- : Empty - no permission r : Read w : Write x : Execute

Absolute or Numeric notation

Permisisons can be displayed in numeric notation. Numerals used are the following:

0 : No permission
1 : Execute (x)
2 : Write (w)
4 : Read (r)

The numbers are added together to form one digit number that represents combination of rwx for either an owner, group or other. For example :

Number	Permission Type	Symbol
0	No Permission	---
1	Execute	--x
2	Write	-w-
3	Execute and Write	-wx
4	Read	r--
5	Read and Execute	r-x
6	Read and Write	rw-
7	Read, Write and Execute	rwx

So the permission rwxrwxrwx is same as 777, rwxr-xr-x is same as 755, and so on.

Change Permissions using Absolute Mode

To change permissions we can use chmod command
For our repos directory we want to :
give full read, write, execute permissions to owner and group, but no permissions to anyone else
We can do this by using chmod command with numeric permission combination 770
```
sudo chmod -R 770 /home/my-usb/repos
```
- NOTE: -R means assign permissions recursively to all the files and folders inside the repos folder
Now if you run ls -l inside /home/my-usb/ you will see that persmissions on repos/ directory have changed to:
```
drwxrwx--- 5 admin developers 4096 Apr 10 02:21 repos
```

Change Permissions using Symbolic Mode

Symbolic mode allows you to change the permission for a particular owner.

To do this you specify owner, followed by mathetmatical operator, followed by symbolic code for access, followed by path to file or directory you want to apply the permissions to.

User denotations

u user/owner

g group

o other

a all
Mathematical operators for changing the permissions

Operator Description

+ adds an acces/permission to a file or directory

- removes the access

= sets the access
Let's assume the file called sample-file.txt with the permissions -rw-r--rw-
Assign the read, write and execute permissions to user group on the file sample-file.txt

chmod g=rwx sample-file.txt
- If we run command ls -l now, we will see that sample-file.txt will have permissions -rw-rwxrw-
Add the execute permission to the user on the file sample-file.txt

chmod u+x sample-file.txt
- If we run command ls -l now, we will see that sample-file.txt will have permissions -rwxrwxrw-
Remove the write permission from the others on the file sample-file.txt

chmod o-w sample-file.txt
- If we run command ls -l now, we will see that sample-file.txt will have permissions -rwxrwxr--

Delete user account

Logged in as admin user,
Disable autologin for user pi (so we can delete this user in next step)
```
sudo raspi-config
```
Select System Options, the Boot / Auto Login and select:
- B2 Console Autologin
Delete the default account we are currently logged into:
- To logout, press [ctrl + d]
- Log back in, but as you newly created admin account using the command "ssh @" and enter your password when prompted
- Delete default account, enter your password when prompted
```
sudo userdel pi
```

Entity	Permission	Permission Description
Owner	7	Read, Write and Execute
Group	5	Read and Execute
Others	0	No Permission

Operator	Description
+	adds an acces/permission to a file or directory
-	removes the access
=	sets the access